ericelliott / ericelliott/credential

Inconsistent use of bytes length/encodings?

Open
#86 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
344
Forks
27
PR merge metrics
No merged PRs in 30d

Description

`createSalt` generates `keyLength` bytes and then transform it in a base64 string. This string is passed to `pbkdf2` as salt, but pbkdf2 treats strings as utf8, so the given salt is not the same random sequence of bytes generated early.
Can be assumed that the salt is still random even if has been expanded by the inconsistent use of the encodings? Are there any security implications? Usually in cryptography when you introduce some fixed points you open yourself to some kind of attacks.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.